1. Field of the Invention
The present invention relates generally to network analysis, and more particularly to a system for generating accurate time stamps for placement on data packets transmitted into, and collected from, local area networks (xe2x80x9cLANxe2x80x9d) and wide area networks (xe2x80x9cWANxe2x80x9d).
2. Description of the Related Art
The analysis and monitoring of LANs and WANs require tools that can collect and disassemble data packets transmitted through many different protocols or formats across a network. To ensure that digital data being transmitted on a network arrives at its intended destination, the data is packaged with header and trailer information which is specific to the type of protocol being used. In order to analyze a network, analysis and monitoring tools need access to the stream of data traveling across the network. Such access points take several forms, such as ports on switches, hubs, and routers, or network interface devices commonly found in personal computers or workstations. Network analysis and monitoring tools connect into the network through these ports or network interfaces.
Network analysis and monitoring tools operate in two principal modes: (1) data collection mode for analysis; and (2) data transmission mode for testing network element behavior based on well-known traffic. In the data collection mode, data collected from a single collection point is disassembled and analyzed in order to determine what is happening on a single segment of the network between two network devices. However, in order to assess network behavior across a network device, such as a switch or router, or between two or more segments, data must be collected from multiple segments. The coordination of data collected from multiple segments is problematic or impossible unless the data is time stamped during transmission between various network devices. For example, to test the amount of time it takes a data packet to travel through a routerxe2x80x94known as the xe2x80x9clatencyxe2x80x9d of the routerxe2x80x94the packet must be time-stamped as it enters the router and again as it exits the router. This time-stamping is only helpful if the entering time stamp is generated from a clock source which is synchronized with the clock source used to generate the exiting time stamp. Without such clock synchronization, the comparison between the time stamps is meaningless, and the accurate determination of the router latency is therefore impossible.
Time stamps on data packets derived from synchronized clocks are also useful during protocol decoding. Protocol decoding is typically accomplished by sending requests in the form of data packets from a first network device to a second network device, and then sending an acknowledgment back from the second device to the first device. Both the request packet and the acknowledgment packet will get a time stamp from the first and second devices. Over time, the request and acknowledgment packets will accumulate in a local cache. If the time stamps are not accurate, i.e., if they are not derived from clocks on both the first and second network devices that are synchronized, then the protocol determination is impossible since the data read from the cache is not accurate. Simply put, it is impossible to decode the protocol without knowing when in time the request packet enters and exits each device relative to when in time the acknowledgment packet enters and exits each device.
Time stamps on data packets derived from synchronized clocks are also useful for trigger operations. During collection of data packets, a filter is typically used to capture certain types of data packets by defining the filter to recognize specific types of packets or portions of packets. A xe2x80x9ctriggerxe2x80x9d is an input condition which further limits the parameters of this filter. For example, a trigger operation can be specified to instruct a filter to capture packets only until a predetermined percentage of memory is full. If filters on numerous analyzer devices located throughout a network have the same trigger operation, then the time stamps on the data packets captured as a result of the filtering must be accurate in order for the information obtained to be meaningful. For example, if the trigger operation described above is used for a first analyzer device, then other analyzer devices in the network must have clocks which are synchronized with the clock of the first analyzer device so that they (1) initiate the capturing packets sequence at precisely the same time as the other devices and (2) capture packets only for the specified amount of time from the time the trigger begins, and no longer. This is important so that the captured data is not overwritten in memory.
A current problem associated with synchronizing clocks from which time stamps on data packets are derived is known as xe2x80x9cclock drift.xe2x80x9d Clock drift refers to the gradual change in the zero reading of a clock occurring naturally over time, causing two clocks initially synchronized to eventually diverge and lose their synchronization. A current system for handling clock drift problems uses low tolerance clocks, where the maximum difference between two low tolerance clocks is very low, such as 2.5 parts per million (xe2x80x9cPPMxe2x80x9d). However, due to its high cost, this is not a very practical solution for peripheral network devices, or other devices which may require tens or hundreds of units installed on a network. Moreover, the clocks of this system still drift to a noticeable difference over time.
Thus, there is a need for a system for synchronizing clocks on devices in a network so that time stamps placed on data packets transmitted into and collected from multiple segments on that network are synchronized with respect to each other. Furthermore, there is a need for a system for synchronizing the initialization of data packet collection on multiple peripheral network devices during the use of trigger operations.
In accordance with the present invention, there is provided a system for generating accurate time stamps on data packets traveling on multiple segments of a LAN or WAN through the use of a common clock for all peripheral network devices. There is also provided a system for synchronizing the initialization of data packet transmission and collection on multiple peripheral network devices through the use of a common industry standard architecture (xe2x80x9cISAxe2x80x9d) address for all devices involved in the data collection.
In particular, the system of the present invention includes at least two peripheral network devices coupled in a master-slave relationship so that the clock source of the master device is used by all the slave devices coupled thereto. In this way, the time stamps placed by the devices on collected data packets are accurate and meaningful since they are all derived from the same clock source.
More specifically, the present invention includes two peripheral network devices, each having its own clock source. One of the peripheral network devices acts as a master device and the other acts as a slave device in a master-slave relationship. This relationship is achieved by connecting a master connector on the designated master device to a slave connector on the designated slave device. The master device sends a clock signal whose frequency is one-half the frequency of the master clock source to the slave device. The slave device receives the one-half frequency clock signal from the master device, doubles the frequency of the clock signal, and uses the master device clock source to drive its time-stamp counters and all system functions. The presence of the cable on the master connector of the master device causes the master device to use its own internal clock source. The presence of the cable on the slave device disables the clock source on the slave device an causes the slave device to use the clock source of the master device to drive all its system functions.
In another aspect of the present invention, at least two peripheral network devices are connected so that all connected devices will capture data packets using the same trigger operation.
In yet another aspect of the invention, at least two peripheral network devices contain a programmable common address register for storage of a common address. This allows a LAN device, such as a personal computer (xe2x80x9cPCxe2x80x9d), to send a signal at the same time to all the peripheral network devices in a LAN instructing the peripheral network devices to begin collecting data, thus synchronizing the time at which data collection initiates.
The features and advantages described in the specification are not all-inclusive, and many additional features and advantages will be apparent to one of ordinary skill in the art in view of the drawings, specification, and claims hereof.